Malware

DebugElevator

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence2

Исследователи ... сообщили о необычной атаке на цепочку поставок ... Вместо этого они изменяли GitHub-теги, подменяя их на коммиты из подконтрольных форков.

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

When developers installed the package via Composer, it would download the malicious code while it appeared to install legitimate Laravel Lang releases.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

PHP-скрипт извлекал встроенный exe-файл и запускал его из временной директории.

T1059.006PythonEvidence1

Вредоносная нагрузка добавляла в пакеты файл src/helpers.php, автоматически подгружаемый через Composer.

T1574Hijack Execution FlowEvidence2

Главной особенностью этой кампании стало использование механики GitHub, позволяющей тегам ссылаться на коммиты из форков того же репозитория. В результате Composer загружал вредоносный код под видом легитимных релизов Laravel Lang.

Stealth

1 technique

T1574Hijack Execution FlowEvidence2

Credential Access

5 techniques

T1539Steal Web Session CookieEvidence1

The Windows infostealer is named 'DebugElevator' and designed to target Chrome, Brave, and Edge, and extract App-Bound Encryption keys needed to decrypt stored browser credentials.

T1552Unsecured CredentialsEvidence2

Финальный пейлоад представлял собой кроссплатформенный PHP-стилер ... Малварь охотилась за облачными учетными данными AWS, GCP и Azure, секретами Kubernetes, токенами HashiCorp Vault, SSH-ключами, конфигурациями Docker и Helm, данными CI/CD-систем, .env-файлами, JWT, токенами GitHub, Slack и Stripe...

T1555Credentials from Password StoresEvidence2

Кроме того, вредонос собирал данные браузеров, менеджеров паролей...

T1555.003Credentials from Web BrowsersEvidence1

этот компонент, получивший имя DebugElevator, атаковал Chrome, Brave и Edge, извлекая ключи App-Bound Encryption для расшифровки сохраненных паролей.

T1649Steal or Forge Authentication CertificatesEvidence1

The malware harvests cloud credentials, Kubernetes secrets, Vault tokens, Git credentials, CI/CD secrets, SSH keys, browser data, cryptocurrency wallets, password managers, VPN configurations, and local `.env` configuration files.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

Для поиска секретов использовались regex-шаблоны, сканировавшие файлы и переменные окружения.

T1083File and Directory DiscoveryEvidence1

Для поиска секретов использовались regex-шаблоны, сканировавшие файлы и переменные окружения.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

Файл выступал в роли дроппера и загружал малварь второй стадии атаки с домена flipboxstudio[.]info.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The researchers say that once the sensitive data has been extracted, the malware encrypts it and sends it back to the C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

xakepNews

May 26, 2026

Пакеты Laravel Lang скомпрометировали для распространения малвари - Хакер

Windows-компонент второй стадии, извлекаемый и запускаемый из временной директории; крадет данные из Chrome, Brave и Edge, получая ключи App-Bound Encryption для расшифровки сохраненных паролей.

bleeping computerNews

May 23, 2026

Laravel Lang packages hijacked to deploy credential-stealing malware

A Windows infostealer dropped by the malicious PHP payload. It targets Chromium-based browsers including Chrome, Brave, and Edge, extracting App-Bound Encryption keys to decrypt stored browser credentials, then enabling theft of sensitive browser data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

DebugElevator

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence2

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

When developers installed the package via Composer, it would download the malicious code while it appeared to install legitimate Laravel Lang releases.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

PHP-скрипт извлекал встроенный exe-файл и запускал его из временной директории.

T1059.006PythonEvidence1

Вредоносная нагрузка добавляла в пакеты файл src/helpers.php, автоматически подгружаемый через Composer.

T1574Hijack Execution FlowEvidence2

Stealth

1 technique

T1574Hijack Execution FlowEvidence2

Credential Access

5 techniques

T1539Steal Web Session CookieEvidence1

The Windows infostealer is named 'DebugElevator' and designed to target Chrome, Brave, and Edge, and extract App-Bound Encryption keys needed to decrypt stored browser credentials.

T1552Unsecured CredentialsEvidence2

T1555Credentials from Password StoresEvidence2

Кроме того, вредонос собирал данные браузеров, менеджеров паролей...

T1555.003Credentials from Web BrowsersEvidence1

T1649Steal or Forge Authentication CertificatesEvidence1

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

Для поиска секретов использовались regex-шаблоны, сканировавшие файлы и переменные окружения.

T1083File and Directory DiscoveryEvidence1

Для поиска секретов использовались regex-шаблоны, сканировавшие файлы и переменные окружения.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

Файл выступал в роли дроппера и загружал малварь второй стадии атаки с домена flipboxstudio[.]info.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The researchers say that once the sensitive data has been extracted, the malware encrypts it and sends it back to the C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

xakepNews

May 26, 2026

Пакеты Laravel Lang скомпрометировали для распространения малвари - Хакер

bleeping computerNews

May 23, 2026

Laravel Lang packages hijacked to deploy credential-stealing malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.